fix: close input normalization aliases

This commit is contained in:
2026-09-02 00:44:38 +03:00
parent 0a34f90bb9
commit 6428b5dcd6
4 changed files with 26 additions and 3 deletions

View File

@@ -60,6 +60,17 @@ describe('content schemas', () => {
})).toThrow(/production hostname is not approved/i);
});
it('rejects preview URL normalization aliases instead of accepting their normalized value', () => {
for (const canonicalUrl of [
'https://portfolio.localhost/.',
'https://portfolio.localhost/%2e',
'https://portfolio.localhost/?',
]) {
expect(() => parseSiteConfig({ environment: 'preview', canonicalUrl, buildId: 'preview-1' }))
.toThrow(/exactly https:\/\/portfolio\.localhost\//i);
}
});
it('rejects controls, non-NFC URLs, and ports at all public URL boundaries', () => {
expect(() => parseSiteConfig({
environment: 'preview', canonicalUrl: 'https://portfolio.localhost/\n', buildId: 'preview-1',